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and Commerce 
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The Honorable John Shimkus 
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Subject: Homeland Security: EPA's Management of Clean Air Act Chemical 
Facility Data 



The events of September 11, 2001, triggered a national re-examination of the security 
of many of the nation's critical infrastructures. Following these events, government 
agencies have struggled to find the right balance between the public's "right to know" 
and the dangers of inappropriate public disclosure of sensitive information. 
Professional and trade groups representing critical infrastructure sectors including 
the chemical industry generally oppose the release of information regarding the 
vulnerability of such facilities. These groups argue that terrorists could use this 
information to target the chemical facilities that are most vulnerable or located near 
population centers. Other groups support communities' right to information about 
hazards to which they might be exposed. Federal, state, and local governments have 
weighed these factors in reassessing the information publicly available in their 
publications and on their Web sites. For this reason, the Environmental Protection 
Agency (EPA) is currently reviewing its management of the chemical facility 
information it has obtained under Clean Air Act provisions. 

Regulations promulgated under Section 112(r) of the Clean Air Act as amended in 
1990 require chemical facilities that produce, use, or store certain hazardous 
chemicals beyond threshold amounts to develop a risk management plan (RMP) to 
detect and prevent or minimize accidental chemical releases. Facilities prepare and 
submit RMPs to EPA at least every 5 years. RMPs contain data about the types and 
amounts of hazardous chemicals in covered processes at a facility; a facility's 
accident history; accident mitigation and prevention measures that are in place; a 
facility's prevention and emergency response program; and the potential effect an 
accidental chemical release could have on the surrounding population, including 
whether schools and residences are located within the area potentially affected by a 
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chemical release. Section 112(r) states that RMPs must be made available to the 
public, as well as to state and local agencies responsible for responding to accidental 
chemical releases. 

In a report issued today, we discuss issues surrounding chemical industry security, 
including the threat posed by chemical facilities, federal requirements addressing 
chemical facility security and the safe management of chemicals, steps taken by 
federal agencies to assess and address security, and voluntary industry actions taken 
to address security concerns. 1 As part of our study of issues surrounding chemical 
industry security, you also asked us to examine EPA's management of Clean Air Act 
chemical facility data. In this report we describe EPA's actions to modify 
management of RMP data in response to the increased terrorist threat since the 
events of September 11, 2001. 

Background 



To implement the requirement in the Clean Air Act Amendments of 1990 for public 
access to chemical facilities' RMPs, EPA planned to make RMPs including analysis of 
the potential impact of a chemical release on the surrounding population, referred to 
as "off-site consequences analysis" (OCA), available to the public over the Internet. 
However, in response to concerns by Justice's Federal Bureau of Investigation and 
other representatives of the law enforcement and intelligence communities, EPA 
decided not to make the sections of facility RMPs consisting of OCA available on its 
Web site. Subsequently, Congress enacted legislation that limited access to those 
sections following testimony expressing concerns about the risk to national security 
associated with posting RMP data on the Internet. The Chemical Safety Information, 
Site Security and Fuels Regulatory Relief Act of 1999 2 established specific provisions 
for public access to portions of RMPs that consist of OCA. Specifically, the act made 
the OCA portions of RMPs and any EPA databases created from those portions 
unavailable under the Freedom of Information Act for at least one year while the 
federal government assessed the risks of posting OCA information on the Internet 
and the benefits of providing public access to the information. The act directed the 
President to issue regulations at the end of the 1-year period governing distribution of 
OCA information in a manner that minimizes the likelihood of accidental releases, the 
increased risk of terrorist or criminal activity associated with posting OCA 
information on the Internet, and the likelihood of harm to public health and welfare. 
The act requires that the regulations allow any member of the public to access paper 
copies of OCA information for a limited number of facilities located anywhere in the 
U.S. and grants other public access as appropriate. The act also directs that the 
regulations provide "covered persons," such as government officials, access to OCA 
information for official use. The act includes specific limitations on the 



1 U.S. General Accounting Office, Homeland Security: Voluntary Initiatives Are Under Way at 
Chemical Facilities, but the Extent of Security Preparedness Is Unknown (GAO-03-439, Mar. 14, 
2003). 

2 P.L. 106-40, 113 Stat. 207 (1999). 
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dissemination by covered persons of OCA information and any statewide or national 
ranking derived from that information. In addition, the act establishes criminal 
penalties for disclosing OCA information in a manner not allowed by the act or 
regulations. The act did not affect access to other non-OCA RMP information, such 
as accident history and prevention and emergency response program information. 
This information remained available through the Internet and the Freedom of 
Information Act. 

Final Rule Covers Management of Most RMP Information 

Following enactment of the Chemical Safety Information, Site Security and Fuels 
Regulatory Relief Act, EPA and the Department of Justice (Justice) conducted 
assessments of the risks of posting OCA information on the Internet and the benefits 
of providing public access to the information and issued a Final Rule in August 2000 
providing methods for access to OCA information. 3 The Final Rule established 
reading rooms as the primary means for the public to access OCA information. In 
response to the Final Rule, EPA and Justice established 54 reading rooms located 
across the nation to provide public access to OCA information. EPA operates 17 
reading rooms primarily through its regional offices, while Justice operates 37 
reading rooms in federal offices around the country. 4 The Final Rule allows members 
of the public to view OCA information for all facilities within the jurisdiction of the 
local emergency response committee (established under the Emergency 
Preparedness and Community Right-to-Know Act) in which an individual lives or 
works and for facilities with potential off-site consequences that could affect that 
jurisdiction, as well as OCA information for up to 10 facilities per month from any 
part of the country. Individuals may read facility OCA information, but may not 
mechanically reproduce or remove this information from the reading room. EPA 
issued guidance to regional offices on developing reading room procedures in 
compliance with the Final Rule and reviewed all region-specific management 
procedures. 

The Final Rule also allows covered persons, defined by the act and regulations as 
federal, state, and local government officials, contractors and agents, members of 
state and local emergency response organizations, and qualified researchers, access 
to OCA information for official purposes. Federal government officials have access 
to all OCA information for official use in electronic form or, by request, in paper 
form. State and local government officials have access to OCA information for 
facilities located in their state and other states upon request. The Final Rule states 
that qualified researchers will have access to OCA information under a separate 
system. However, EPA is not currently developing a system. Covered persons are 
generally prohibited from disseminating OCA information to the public or to state 
and local government officials. However, state and local government officials can 
disseminate the information to other state and local government officials in their 
state or in a contiguous state. They can also share OCA data elements — pieces of 
OCA information that are not in the format of restricted OCA portions of RMPs or in 
the format of EPA's electronic database. EPA states that it receives hundreds of 



3 65 Fed. Reg. 48108 (Aug. 4, 2000). 

4 Justice generally administers its reading rooms similarly to EPA reading rooms. 
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written requests from covered persons for RMPs including restricted OCA 
information, and disseminates information in response to these requests in 
accordance with the Final Rule. 

Further, the Final Rule makes available on the Internet only OCA data elements that a 
Justice risk assessment concluded would pose the least security risk if posted on the 
Internet. The Final Rule specifies that only the following OCA data elements will be 
available through EPA's Web site: 

• concentration and physical state of the facility's chemical; 

• duration of the chemical release under the worst-case scenario and the 
endpoint used for flammable chemicals in the worst-case scenario; 

• the statistical model used; 

• wind speed during the chemical release, atmospheric stability, and topography 
of the surrounding area; and 

• safety mitigation systems the facility considered. 

The Final Rule precludes posting other OCA data elements such as the name and 
quantity of facilities' worst-case scenario chemicals, residential population that could 
be affected by a facility's worst-case chemical release, and maps or graphics 
illustrating the worst-case scenario. 

OCA information and other RMP data may also be available to the public through 
state and local emergency planning organizations and through chemical facilities. 
The Final Rule encourages local and state emergency planning organizations to 
provide read-only access to information about facilities located within an individual's 
emergency response jurisdiction or with potential off-site consequences that could 
affect the jurisdiction. EPA officials told us that while the agency still encourages 
state and local organizations to share OCA information with the public, it also 
provides guidance to these organizations on complying with statutory and regulatory 
restrictions on distributing the information. EPA officials told us that state and local 
organizations continue to share RMP data and, to a lesser extent, OCA information 
with the public, but on a more limited basis since September 11, 2001. In addition, 
the public may receive information about facilities' risks and potential off-site 
consequences through public meetings. Virtually all facilities were required by the 
Chemical Safety Information, Site Security and Fuels Regulatory Relief Act to hold 
one public meeting to describe and discuss the local effects of their RMPs, including 
a summary of OCA portions of their RMPs. 

EPA Has Modified Management of Information, but Further Changes Would 
Require Legislative or Regulatory Action 

In response to heightened concern about terrorist attacks after September 11, 2001, 
EPA made changes to its dissemination of RMP data. Because of concerns about 
security, EPA removed the RMP database posted on its Web site on September 20, 



Page 4 



GAO-03-509R EPA's Management of Clean Air Act Data 



2001. 5 Furthermore, officials at some EPA regional offices told us they made minor 
changes to their reading room operations to exercise more caution over OCA 
information after September 11, 2001. For example, EPA regional officials told us 
that two regions began conducting limited background checks through the agency's 
Criminal Investigation Division units before allowing individuals to access the 
information. In response, EPA headquarters officials advised regions against 
implementing additional safeguards inconsistent with the Final Rule. 

In general, the public has shown limited interest in accessing OCA information, both 
before and after September 11, 2001. Most EPA reading rooms had not hosted a visit 
before September 11, 2001. EPA officials report that EPA's 17 reading rooms hosted 
about 180 visits in 2002, and a total of more than 200 visits since the reading rooms 
were created. 6 These numbers may include repeated visits by the same individual. 
Moreover, EPA officials told us that the agency has received 18 requests for RMP data 
from members of the public by e-mail or in writing; 14 requests were received after 
September 11, 2001. EPA responded to all requests for RMP data excluding OCA 
information. The agency provided two additional requesters with the entire RMP 
database, excluding OCA information and RMP executive summaries. With the 
consent of these requesters, the agency excluded executive summaries because of 
increased concern over descriptions of OCA contained in this portion of some 
facilities' RMPs. 

EPA officials reported that changes to the management of RMP data were made in 
response to the increased threat of terrorist activity, not in response to any breaches 
in the security of OCA information or the RMP database generally. EPA officials told 
us that to their knowledge, no unauthorized access to OCA information has occurred. 
OCA information has been distributed in other formats to members of the public. For 
example, in several instances, journalists have accessed OCA information in reading 
rooms and then published lists identifying the most dangerous chemical facilities in a 
geographic area. These reports included facility names, the toxic chemicals housed 
at each facility, and the number of people that a chemical release at each facility 
could potentially affect. Chemical industry groups have voiced concern over this 
dissemination of facility information, arguing that terrorists could use the information 
to target facilities that are most vulnerable or located near large population centers. 
EPA officials also stated that some environmental and public interest groups copied 
the RMP database, which did not include OCA data elements other than those 
elements found less sensitive by Justice, from EPA's Web site prior to September 
2001 and made this data available on the Internet. However, officials stated that this 
information will become outdated as time passes because EPA has not made 
available the updated facility RMPs it receives. 

EPA is currently reviewing its management of RMP data. EPA officials are working 
with Justice to determine whether to put RMPs, excluding restricted OCA 
information, back on the Internet and whether to restrict public access to other 
portions of RMPs such as executive summaries, which contain descriptions of OCA 



5 Non-OCA RMP information remained available through the Freedom of Information Act. 

6 Justice reports that its 37 reading rooms have hosted fewer than 50 visits. 
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information. Even before the events of September 11, 2001, Justice expressed 
significant concern over general, public access to sensitive information included in 
chemical facility RMPs, which Justice concluded is particularly attractive targeting 
information for terrorists. Justice supports draft legislation that would better protect 
OCA information and prohibit general, public access to OCA information in facility 
RMPs. Because the existing statutory and regulatory framework governs access to 
RMPs and OCA information, EPA officials stated that additional changes to the 
management and distribution of this data would require legislative or regulatory 
action. 

Agency Comments and Our Evaluation 

We provided a draft of this letter to EPA for its review and comment. EPA agreed 
with the letter's facts and provided technical comments and clarifications, which we 
incorporated as appropriate. 

Scope and Methodology 



To determine EPA's management of Clean Air Act data under the Section 112(r) Risk 
Management Plan provisions, we interviewed officials from EPA headquarters and 
officials from EPA's 10 regional offices. We also reviewed statutes and regulations to 
determine the relevant statutory framework. In addition, we spoke with Justice 
about the agency's procedures for operating reading rooms. 

We conducted our work from April 2002 through March 2003 in accordance with 
generally accepted government auditing standards. 



As agreed with your office, unless you publicly announce the contents of this report 
earlier, we plan no further distribution of it until 30 days after the date of this letter. 
At that time, we will send copies to other interested parties and make copies 
available to others who request them. In addition, the report will be available on 
GAO's Web site at http://www.gao.gov. 
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If you or your staff have any questions about this letter, please contact me or Peg 
Reese at (202) 512-3841. Major contributors to this report were Paige Gilbreath, 
Joanna McFarland, Amy Webbink, and Leigh White. 



John B. Stephenson 
Director, Natural Resources and 
Environment 
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